Learning DNS - DNSSEC: Zone Signing (Authoritative)

#Introduction

Until now, DNS clients could only trust answers on faith. DNSSEC changes that: every record is cryptographically signed, so the receiver can verify that the answer genuinely comes from the zone owner and wasn't altered in transit.

Episode 13 covers the Authoritative side: the KSK and ZSK concepts, signing algorithms, DNSSEC records, signing practice with pdnsutil, and how to publish the DS to your registrar. In episode 14 we'll look at the verification side in the Recursor.

#DNSSEC Concepts

#KSK and ZSK

DNSSEC uses two layers of keys:

• KSK (Key Signing Key): a long-term key that signs other keys (DNSKEY). Its security is guarded extra strictly.
• ZSK (Zone Signing Key): a short-term key that signs all ordinary records. Rotated frequently because it's used often.

KSK menandatangani DNSKEY
ZSK menandatangani record (RRSIG)
DS menghubungkan zone ke parent

This separation lets you rotate the ZSK often without changing the DS published to the registrar, while the KSK is rarely rotated.

#Supported Algorithms

PowerDNS supports RSA and elliptic curves:

• RSA (rsasha256, algorithm 8): the most widely supported, good for interoperability.
• ECDSA P-256 (ecdsap256sha256, algorithm 13): shorter signatures and lighter CPU use, the modern default.

#DNSSEC Records

#DNSKEY, RRSIG, DS, NSEC, NSEC3

DNSSEC adds five record types:

• DNSKEY: the zone's public key.
• RRSIG: the digital signature of one RRset.
• DS (Delegation Signer): the fingerprint of the KSK published to the parent zone — the link in the chain of trust.
• NSEC/NSEC3: prove that a name really doesn't exist, preventing forged NXDOMAIN answers.

dig @127.0.0.1 example.com DNSKEY +noall +answer +multiline
dig @127.0.0.1 example.com SOA +dnssec +noall +answer

dig +dnssec shows records along with their RRSIGs. You'll see flags on the DNSKEY: 257 marks a KSK, 256 marks a ZSK.

#Signing Zones in PowerDNS

#pdnsutil secure-zone

Signing a zone is as simple as one command:

pdnsutil secure-zone example.com
pdnsutil show-zone example.com

pdnsutil secure-zone creates KSK and ZSK keys then signs the entire zone. pdnsutil show-zone displays key details, serial, and the DS records that must be published. To force a specific algorithm:

pdnsutil secure-zone example.com ecdsap256sha256

#Key Rotation

Keys used continuously must be rotated. ZSK rotation is routine, while KSK rotation is rare and planned because it involves changing the DS at the parent:

pdnsutil add-zone-key example.com zsk ecdsap256sha256 active
pdnsutil remove-zone-key example.com <key-id-lama>
pdnsutil rectify-zone example.com

pdnsutil add-zone-key adds a new ZSK in active state, then the old key is removed once its signatures are no longer used.

#Publishing DS and Signing Modes

#Publishing DS to the Registrar

For the chain of trust to hold, the DS record must be published to the parent zone through your registrar:

pdnsutil show-zone example.com
pdnsutil export-ds example.com

pdnsutil export-ds example.com shows the DS records you copy into the registrar's panel. Without this DS, validators have no anchor point to verify your zone.

#Pre-signed vs Online Signing

PowerDNS supports two signing modes:

• Pre-signed: records are signed when changes happen, then stored. Infrequent changes suit this mode.
• Online signing: signatures are created when a query arrives, using HSM/PKCS#11 to store keys securely. Frequent changes and large zones use this mode.

pdnsutil set-zone-option example.com NSEC3NARROW 1

The mode is chosen per zone via pdnsutil set-zone-option. Signature maintenance (resigning) runs automatically based on default-signing-ttl.

#Conclusion

Episode 13 makes your zones verifiable: understanding KSK/ZSK and algorithms, reading DNSKEY, RRSIG, DS, and NSEC, signing zones with pdnsutil secure-zone, rotating keys, and publishing DS to your registrar.

Key takeaways:

• KSK signs DNSKEY; ZSK signs all records; DS connects to the parent.
• ECDSA P-256 is the modern default; RSA for broad interoperability.
• pdnsutil secure-zone signs a zone; export-ds produces the DS for the registrar.
• ZSK rotation is routine; KSK rotation is rare and planned.
• Pre-signed for infrequent changes; online signing with HSM for frequent changes.

In episode 14, we'll cover DNSSEC: validation on the Recursor side — enabling dnssec: process, bootstrapping trust anchors from IANA, testing with dig +dnssec, reading the AD flag, trust anchor management, and handling unsigned zones or broken signatures.